NGFW-Engineer PAN OS Networking Configuration Practice Test 2 — 15 Questions

Question 1

A network architect is designing a Palo Alto Networks firewall deployment that requires policy-based forwarding (PBF) to route specific traffic out of a particular ISP link based on the source IP address. The firewall has two ISP connections on different interfaces. The architect wants to ensure that if the primary ISP link fails, traffic is automatically rerouted to the secondary ISP. Which PAN-OS feature should be used to monitor the primary ISP link and trigger the PBF rule to use the secondary link?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy-Based Forwarding (PBF) with a link monitoring profile. Policy-Based Forwarding (PBF) with a link monitoring profile allows the firewall to monitor the health of a specific ISP link. If the monitored IP becomes unreachable, the PBF rule is deactivated, and traffic can be forwarded using the next matching rule or the routing table, which can point to the secondary ISP. This provides automatic failover for policy-based forwarding. Other options like dynamic routing or static routes do not offer the same granular, policy-based control.

Answer

Static routes with path monitoring

Answer

Dynamic routing with OSPF and BFD

Answer

HA active/active configuration with link monitoring

Question 2

An administrator is setting up a new Palo Alto Networks firewall and needs to configure a loopback interface to be used as the router ID for OSPF. Which configuration step is required to make the loopback interface usable for this purpose?

Accepted Answer

Assign an IP address to the loopback interface and ensure it is up/up.. The OSPF router ID on a Palo Alto Networks firewall is determined by the highest IP address of a loopback interface that is up/up, or if none, the highest IP of a physical interface. Therefore, the essential step is to assign an IP address to the loopback interface and ensure it is operational. Security zone assignment, passive mode, or enabling OSPF on the interface are not prerequisites for router ID selection.

Answer

Assign an IP address to the loopback interface and enable OSPF on it.

Answer

Assign an IP address to the loopback interface and add it to a security zone.

Answer

Assign an IP address to the loopback interface and configure it as a passive interface in OSPF.

Question 3

An engineer configures a Layer 3 interface on a PA-3220 with two IP addresses: 10.1.1.1/24 and 10.2.2.1/24. The interface is assigned to the 'trust' zone in virtual router 'default'. Users on 10.1.1.0/24 report they can reach the internet, but users on 10.2.2.0/24 cannot. The firewall's routing table shows a default route via 10.1.1.254. No policy denies traffic from the trust zone. What is the most likely cause?

Accepted Answer

The default route is reachable only via 10.1.1.254, so return traffic for 10.2.2.0/24 is sent to the wrong next hop or dropped due to asymmetric routing.. The correct answer focuses on the routing asymmetry caused by the default route being on the 10.1.1.0/24 subnet. Even though the interface has both IPs, return traffic for 10.2.2.0/24 will follow the default route to 10.1.1.254, which may not have a path back to 10.2.2.0/24, or the firewall may drop packets if it sees them arriving on a different interface than expected. Ensuring proper routing or adding a specific route for 10.2.2.0/24 solves the problem.

Answer

The second IP address requires a separate Layer 3 interface because PAN-OS supports only one IP per interface.

Answer

A security policy must explicitly allow traffic from the 10.2.2.0/24 subnet because the trust zone only permits 10.1.1.0/24 by default.

Answer

The firewall requires a separate virtual router for each IP subnet assigned to an interface.

Question 4

A network engineer is configuring a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the tunnel interface IP address is correctly configured and that the tunnel can be used for routing. Which configuration step is required to assign an IP address to the tunnel interface?

Accepted Answer

Configure the tunnel interface as a Layer 3 interface and assign a static IP address in the same subnet as the remote tunnel interface.. To use a tunnel interface for routing, it must be configured as a Layer 3 interface with an IP address. This IP address should be in the same subnet as the remote tunnel interface to enable direct communication. Assigning the tunnel interface to a virtual router and zone is also necessary, but the IP address assignment is the key step for routing functionality.

Answer

Configure a static route to the remote network pointing to the tunnel interface, and the firewall will automatically assign an IP address to the tunnel interface.

Answer

Use a loopback interface with an IP address and reference it in the IPsec tunnel configuration as the local identity.

Answer

Create a tunnel interface in the Network > Interfaces > Tunnel section and assign it to a virtual router and a security zone.

Question 5

A PAN-OS firewall is deployed in a high-availability (HA) active/passive configuration. The administrator needs to ensure that the HA1 control link remains operational even if the primary HA1 link fails. Which two configurations achieve this? (Choose two.)

Accepted Answer

Enable HA1 backup link and specify a different physical interface for it.. To ensure HA1 control link redundancy, you must configure an HA1 backup link on a separate physical interface. This provides an alternate path for HA control traffic if the primary link fails. Both options that specify a separate physical interface for the backup are correct. Other options do not provide link redundancy.

Answer

Configure HA1 backup link on a different subnet than the primary HA1 link.

Answer

Enable HA1 encryption and configure a dedicated VLAN for HA traffic.

Answer

Use the same physical interface for HA1 and HA2 with VLAN tagging.

Question 6

An engineer is configuring a site-to-site VPN between two Palo Alto Networks firewalls. The engineer needs to ensure that the VPN tunnel can be established and that traffic is properly routed. Which two configurations are required on each firewall to enable the VPN tunnel to come up? (Choose two.)

Accepted Answer

IKE Gateway with matching pre-shared key. The IKE Gateway and IPSec Crypto Profile are the core Phase 1 and Phase 2 parameters that must match between peers for a site-to-site VPN to establish. The IKE Gateway handles authentication and peer identification, while the IPSec Crypto Profile defines the encryption and integrity algorithms. Without these, the tunnel cannot negotiate.

Answer

Security policy allowing IKE and IPSec traffic

Answer

Static route pointing to the remote network via the tunnel interface

Answer

Tunnel interface with an IP address

Question 7

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP relay. The DHCP server is located on a different subnet than the DHCP clients. Which two configurations are required to enable DHCP relay on the firewall? (Choose two.)

Accepted Answer

Enable DHCP relay on the interface facing the DHCP clients.. To enable DHCP relay, you must enable relay on the interface receiving client DHCP broadcasts and specify the DHCP server's IP address in that relay configuration. The firewall then forwards requests to the server and relays responses back to clients. No security policy is needed because relay traffic is handled internally.

Answer

Configure a DHCP server profile with the IP address of the DHCP server.

Answer

Configure a static route to the DHCP server subnet.

Answer

Create a security policy allowing UDP ports 67 and 68 between the clients and the server.

Question 8

A network engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an external router using OSPF. The engineer wants to ensure that the firewall's OSPF router ID is stable and does not change if a physical interface goes down. Which configuration should the engineer use?

Accepted Answer

Configure a loopback interface with an IP address and use it as the OSPF router ID.. Assigning a loopback interface IP as the OSPF router ID provides a stable identifier that does not change when physical interfaces go down. This prevents OSPF adjacency resets and routing instability. In PAN-OS, the router ID is configured under the OSPF settings, and using a loopback is a recommended practice.

Answer

Enable OSPF on all physical interfaces and let the firewall automatically select the router ID.

Answer

Configure a static route to the OSPF neighbor and use the next-hop IP as the router ID.

Answer

Use the highest IP address of any physical interface as the OSPF router ID.

Question 9

A network administrator is configuring a new Layer 3 interface on a PAN-OS firewall. The interface will be used to route traffic between two subnets. Which configuration is required to enable the interface to forward traffic?

Accepted Answer

Assign the interface to a security zone and create a security policy allowing traffic.. A Layer 3 interface must be assigned to a security zone to be used in security policies. Without a zone, the firewall cannot apply security rules, and traffic will not be forwarded. Creating a security policy that allows the desired traffic is also required. The virtual router assignment is necessary for routing, but zone and policy are the direct enablers for forwarding.

Answer

Enable the interface as a DHCP client to obtain an IP address.

Answer

Set the interface to Layer 2 mode and create a VLAN interface.

Answer

Configure a virtual router and assign the interface to it.

Question 10

An administrator is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF). The administrator wants to ensure that traffic matching a PBF rule is forwarded correctly. Which two actions must be taken when creating a PBF rule? (Choose two.)

Accepted Answer

Specify the source zone and source address in the PBF rule.. The correct answers are to specify the source zone and source address, and to define the outgoing interface or next-hop. A PBF rule must have match criteria to identify traffic, such as source zone and source address. It must also have an action that specifies where to forward the traffic, either an outgoing interface or a next-hop IP. These two elements are essential for the rule to operate.

Answer

Enable symmetric return to ensure return traffic uses the same path.

Answer

Specify the destination zone in the PBF rule.

Answer

Configure a security policy rule to allow the traffic before the PBF rule.

Question 11

An administrator is configuring a new subnet on a Layer 3 interface of a PA-3260. The subnet is 192.168.10.0/24, and the interface is in zone 'dmz' with virtual router 'default'. The administrator wants the firewall to respond to ARP requests for 192.168.10.1 and also to forward traffic for other IPs in the subnet to a downstream router at 192.168.10.2. Which configuration achieves this?

Accepted Answer

Assign IP 192.168.10.1/24 to the interface and configure a static route for specific host addresses or a narrower subnet pointing to 192.168.10.2.. The correct answer involves adding more specific static routes for the addresses that should be forwarded to the downstream router. The interface's connected route covers the entire /24, but more specific routes (like /32 or a smaller subnet) take precedence. This allows the firewall to act as the gateway for some hosts while forwarding traffic for others to 192.168.10.2. Proxy ARP is not needed because the downstream router will respond to ARP for its own IPs, or the firewall can be configured with a static ARP if necessary.

Answer

Assign IP 192.168.10.1/24 to the interface and enable Proxy ARP for the subnet.

Answer

Assign IP 192.168.10.1/24 to the interface and add a static route for 192.168.10.0/24 with next hop 192.168.10.2.

Answer

Assign IP 192.168.10.1/24 to the interface and configure a static route for 192.168.10.0/25 with next hop 192.168.10.2, while ensuring the downstream router handles the other half.

Question 12

A network administrator is setting up a new Palo Alto Networks firewall and needs to configure the management interface. The administrator wants to access the firewall's web interface from a computer on the 10.0.0.0/24 network. The management interface is currently configured with IP address 192.168.1.1/24. Which action must the administrator take to allow access from the 10.0.0.0/24 network?

Accepted Answer

Configure a management interface profile that permits HTTPS access from the 10.0.0.0/24 network.. Management interface access is controlled by management interface profiles. To allow access from the 10.0.0.0/24 network, the administrator must configure a management profile that includes that network and permits HTTPS. Security policies and static routes do not affect management plane access. Changing the IP address is unnecessary and disruptive.

Answer

Add a static route to the 10.0.0.0/24 network via the management interface.

Answer

Create a security policy allowing traffic from the 10.0.0.0/24 zone to the management zone.

Answer

Change the management interface IP address to be in the 10.0.0.0/24 subnet.

Question 13

An administrator is setting up a new Palo Alto Networks firewall and needs to configure the management interface. The administrator wants to ensure that the firewall can be managed via HTTPS from the internal network. Which configuration is required?

Accepted Answer

Assign an IP address to the MGT interface and enable HTTPS in the management interface settings.. To manage the firewall via HTTPS on the MGT interface, you must assign an IP address and enable the HTTPS service in the interface configuration. The MGT interface is dedicated for management, and enabling HTTPS allows secure web access. Management profiles are optional for restricting access but not required for enabling the service.

Answer

Configure a management profile on the MGT interface and allow HTTPS.

Answer

Enable HTTP and then redirect to HTTPS in the management profile.

Answer

Configure a Layer 3 interface on a data port and enable HTTPS in the device settings.

Question 14

A firewall administrator needs to configure a new Layer 2 interface on a PA-220. The interface will connect to a switch and carry traffic for VLAN 10 and VLAN 20. The administrator wants the firewall to inspect traffic between these VLANs. Which configuration is required?

Accepted Answer

Create a Layer 3 interface with subinterfaces, each assigned to a VLAN tag and a zone, then configure security policies between the zones.. The correct answer is to use Layer 3 subinterfaces. Each subinterface is configured with a VLAN tag and an IP address, and assigned to a zone. The firewall then routes traffic between the subinterfaces, and security policies enforce rules between the zones. This allows inspection of inter-VLAN traffic. Layer 2 interfaces and virtual wire do not provide routing, so they cannot achieve the goal.

Answer

Create a virtual wire interface pair and assign VLAN tags to the interfaces.

Answer

Create a Layer 2 interface, assign it to a zone, and create a VLAN interface for each VLAN.

Answer

Create a Layer 2 interface and enable VLAN trunking; the firewall will automatically route between VLANs.

Question 15

A security engineer is configuring a Palo Alto Networks firewall to use Policy-Based Forwarding (PBF) to route traffic from a specific source subnet through a dedicated ISP link. The engineer creates a PBF policy with the source subnet and a forward-to next-hop of the ISP gateway. However, traffic is still being routed via the default route. Which two actions should the engineer take to ensure the PBF policy is applied? (Choose two.)

Accepted Answer

Confirm that the PBF policy's source and destination zones are correctly defined and that the policy is not disabled.. PBF policies are evaluated in order, so a more specific rule must be above broader rules to take effect. Additionally, the policy must be enabled and have correct source and destination zones to match traffic. Both conditions are necessary for the PBF rule to be applied instead of the default route.

Answer

Check that the next-hop IP address in the PBF policy is reachable via the virtual router's routing table.

Answer

Enable 'Enforce Symmetric Return' in the PBF policy to ensure return traffic uses the same path.

Answer

Verify that the source subnet is not also matched by a more specific route in the virtual router's routing table.